Adds or overwrites one or more tags for the specified resource.

Tags are metadata that you can assign to your documents, managed instances, maintenance windows, Parameter Store parameters, and patch baselines. Tags enable you to categorize your resources in different ways, for example, by purpose, owner, or environment. Each tag consists of a key and an optional value, both of which you define. For example, you could define a set of tags for your account's managed instances that helps you track each instance's owner and stack level. For example: Key=Owner and Value=DbAdmin, SysAdmin, or Dev. Or Key=Stack and Value=Production, Pre-Production, or Test.

Each resource can have a maximum of 50 tags.

We recommend that you devise a set of tag keys that meets your needs for each resource type. Using a consistent set of tag keys makes it easier for you to manage your resources. You can search and filter the resources based on the tags you add. Tags don't have any semantic meaning to and are interpreted strictly as a string of characters.

Attempts to cancel the command specified by the Command ID.

Stops a maintenance window execution that is already in progress and cancels any tasks in the window that have not already starting running.

Generates an activation code and activation ID you can use to register your on-premises server or virtual machine (VM) with Systems Manager.

Registering these machines with Systems Manager makes it possible to manage them using Systems Manager capabilities. You use the activation code and ID when installing SSM Agent on machines in your hybrid environment. For more information about requirements for managing on-premises instances and VMs using Systems Manager, see Setting up AWS Systems Manager for hybrid environments in the AWS Systems Manager User Guide.

A State Manager association defines the state that you want to maintain on your instances.

Associates the specified Systems Manager document with the specified instances or targets.

When you associate a document with one or more instances using instance IDs or tags, SSM Agent running on the instance processes the document and configures the instance as specified.

Creates a Systems Manager (SSM) document.

Creates a new maintenance window.

Creates a new OpsItem.

You must have permission in AWS Identity and Access Management (IAM) to create a new OpsItem. For more information, see Getting started with OpsCenter in the AWS Systems Manager User Guide.

Creates a patch baseline.

A resource data sync helps you view data from multiple sources in a single location.

Systems Manager offers two types of resource data sync: SyncToDestination and SyncFromSource.

You can configure Systems Manager Inventory to use the SyncToDestination type to synchronize Inventory data from multiple AWS Regions to a single S3 bucket. For more information, see Configuring Resource Data Sync for Inventory in the AWS Systems Manager User Guide.

You can configure Systems Manager Explorer to use the SyncFromSource type to synchronize operational work items (OpsItems) and operational data (OpsData) from multiple AWS Regions to a single S3 bucket. This type can synchronize OpsItems and OpsData from multiple AWS accounts and Regions or EntireOrganization by using AWS Organizations. For more information, see Setting up Systems Manager Explorer to display data from multiple accounts and Regions in the AWS Systems Manager User Guide.

A resource data sync is an asynchronous operation that returns immediately. After a successful initial sync is completed, the system continuously syncs data. To check the status of a sync, use the ListResourceDataSync.

Deletes an activation.

Disassociates the specified Systems Manager document from the specified instance.

Deletes the Systems Manager document and all instance associations to the document.

Delete a custom inventory type or the data associated with a custom Inventory type.

Deletes a Resource Data Sync configuration.

Removes the server or virtual machine from the list of registered servers.

Describes the association for the specified target or instance.

Describes the permissions for a Systems Manager document.

Retrieves the current effective patches (the patch and the approval state) for the specified patch baseline.

Describes one or more of your instances, including information about the operating system platform, the version of SSM Agent installed on the instance, instance status, and so on.

If you specify one or more instance IDs, it returns information for those instances. If you do not specify instance IDs, it returns information for all your instances. If you specify an instance ID that is not valid or an instance that you do not own, you receive an error.

Lists the executions of a maintenance window.

Lists the tasks in a maintenance window.

Query a set of OpsItems.

You must have permission in AWS Identity and Access Management (IAM) to query a list of OpsItems. For more information, see Getting started with OpsCenter in the AWS Systems Manager User Guide.

Get information about a parameter.

Lists the properties of available patches organized by product, product family, classification, severity, and other properties of available patches.

You can use the reported properties in the filters you specify in requests for actions such as CreatePatchBaseline, UpdatePatchBaseline, DescribeAvailablePatches, and DescribePatchBaselines.

The following section lists the properties that can be used in filters for each major operating system type:

AMAZON_LINUX

Valid properties: PRODUCT, CLASSIFICATION, SEVERITY

AMAZON_LINUX_2

Valid properties: PRODUCT, CLASSIFICATION, SEVERITY

CENTOS

Valid properties: PRODUCT, CLASSIFICATION, SEVERITY

DEBIAN

Valid properties: PRODUCT, PRIORITY

MACOS

Valid properties: PRODUCT, CLASSIFICATION

ORACLE_LINUX

Valid properties: PRODUCT, CLASSIFICATION, SEVERITY

REDHAT_ENTERPRISE_LINUX

Valid properties: PRODUCT, CLASSIFICATION, SEVERITY

SUSE

Valid properties: PRODUCT, CLASSIFICATION, SEVERITY

UBUNTU

Valid properties: PRODUCT, PRIORITY

WINDOWS

Valid properties: PRODUCT, PRODUCT_FAMILY, CLASSIFICATION, MSRC_SEVERITY

Gets the state of the AWS Systems Manager Change Calendar at an optional, specified time.

If you specify a time, GetCalendarState returns the state of the calendar at a specific time, and returns the next time that the Change Calendar state will transition. If you do not specify a time, GetCalendarState assumes the current time. Change Calendar entries have two possible states: OPEN or CLOSED.

If you specify more than one calendar in a request, the command returns the status of OPEN only if all calendars in the request are open. If one or more calendars in the request are closed, the status returned is CLOSED.

Retrieves the default patch baseline.

Note that Systems Manager supports creating multiple default patch baselines. For example, you can create a default patch baseline for each operating system.

Retrieves the current snapshot for the patch baseline the instance uses.

Lists the tasks in a maintenance window.

Get information about an OpsItem by using the ID.

You must have permission in AWS Identity and Access Management (IAM) to view information about an OpsItem. For more information, see Getting started with OpsCenter in the AWS Systems Manager User Guide.

Get information about a parameter by using the parameter name.

Get details of a parameter.

Retrieve information about one or more parameters in a specific hierarchy.

ServiceSetting is an account-level setting for an AWS service.

This setting defines how a user interacts with or uses a service or a feature of a service. For example, if an AWS service charges money to the account based on feature or service usage, then the AWS service team might create a default setting of "false". This means the user can't use this feature unless they change the setting to "true" and intentionally opt in for a paid feature.

Services map a SettingId object to a setting value. AWS services teams define the default value for a SettingId. You can't create a new SettingId, but you can overwrite the default value if you have the ssm:UpdateServiceSetting permission for the setting. Use the UpdateServiceSetting API action to change the default setting. Or use the ResetServiceSetting to change the value back to the original value defined by the AWS service team.

A parameter label is a user-defined alias to help you manage different versions of a parameter.

When you modify a parameter, Systems Manager automatically saves a new version and increments the version number by one. A label can help you remember the purpose of a parameter when there are multiple versions.

Parameter labels have the following requirements and restrictions.

• A version of a parameter can have a maximum of 10 labels.

• You can't attach the same label to different versions of the same parameter. For example, if version 1 has the label Production, then you can't attach Production to version 2.

• You can move a label from one version of a parameter to another.

• You can't create a label when you create a new parameter. You must attach a label to a specific version of a parameter.

• You can't delete a parameter label. If you no longer want to use a parameter label, then you must move it to a different version of a parameter.

• A label can have a maximum of 100 characters.

• Labels can contain letters (case sensitive), numbers, periods (.), hyphens (-), or underscores (_).

• Labels can't begin with a number, "aws," or "ssm" (not case sensitive). If a label fails to meet these requirements, then the label is not associated with a parameter and the system displays it in the list of InvalidLabels.

Returns all State Manager associations in the current AWS account and Region.

An invocation is copy of a command sent to a specific instance.

For a specified resource ID, this API action returns a list of compliance statuses for different resource types.

Returns a summary count of compliant and non-compliant resources for a compliance type.

Returns all Systems Manager (SSM) documents in the current AWS account and Region.

Returns a list of all OpsItem events in the current AWS account and Region.

Returns a resource-level summary count.

Lists your resource data sync configurations.

Includes information about the last time a sync attempted to start, the last sync status, and the last time a sync successfully completed.

Shares a Systems Manager document publicly or privately.

Registers a compliance type and other compliance details on a designated resource.

This action lets you register custom compliance details with a resource. This call overwrites existing compliance information on the resource, so you must provide a full list of compliance items each time that you send the request.

ComplianceType can be one of the following:

• ExecutionId: The execution ID when the patch, association, or custom compliance item was applied.

• ExecutionType: Specify patch, association, or Custom:string.

• ExecutionTime. The time the patch, association, or custom compliance item was applied to the instance.

• Id: The patch, association, or custom compliance ID.

• Title: A title.

• Status: The status of the compliance item. For example, approved for patches, or Failed for associations.

• Severity: A patch severity. For example, critical.

• DocumentName: A SSM document name. For example, AWS-RunPatchBaseline.

• DocumentVersion: An SSM document version number. For example, 4.

• Classification: A patch classification. For example, security updates.

• PatchBaselineId: A patch baseline ID.

• PatchSeverity: A patch severity. For example, Critical.

• PatchState: A patch state. For example, InstancesWithFailedPatches.

• PatchGroup: The name of a patch group.

• InstalledTime: The time the association, patch, or custom compliance item was applied to the resource. Specify the time by using the following format: yyyy-MM-dd'T'HH:mm:ss'Z'

Bulk update custom inventory items on one more instance.

Defines the default patch baseline for the relevant operating system.

ServiceSetting is an account-level setting for an AWS service.

This setting defines how a user interacts with or uses a service or a feature of a service. For example, if an AWS service charges money to the account based on feature or service usage, then the AWS service team might create a default setting of "false". This means the user can't use this feature unless they change the setting to "true" and intentionally opt in for a paid feature.

Services map a SettingId object to a setting value. AWS services teams define the default value for a SettingId. You can't create a new SettingId, but you can overwrite the default value if you have the ssm:UpdateServiceSetting permission for the setting. Use the GetServiceSetting API action to view the current value. Use the UpdateServiceSetting API action to change the default setting.

Reconnects a session to an instance after it has been disconnected.

Connections can be resumed for disconnected sessions, but not terminated sessions.

Use this API action to run an association immediately and only one time.

Creates a change request for Change Manager.

Initiates a connection to a target (for example, an instance) for a Session Manager session.

Returns a URL and token that can be used to open a WebSocket connection for sending input and receiving outputs.

AWS CLI usage: start-session is an interactive command that requires the Session Manager plugin to be installed on the client machine making the call. For information, see Install the Session Manager plugin for the AWS CLI in the AWS Systems Manager User Guide.

Permanently ends a session and closes the data connection between the Session Manager client and SSM Agent on the instance.

Updates an association.

You can update the association name and version, the document version, schedule, parameters, and Amazon S3 output.

In order to call this API action, your IAM user account, group, or role must be configured with permission to call the DescribeAssociation API action. If you don't have permission to call DescribeAssociation, then you receive the following error: An error occurred (AccessDeniedException) when calling the UpdateAssociation operation: User: <user_arn> is not authorized to perform: ssm:DescribeAssociation on resource: <resource_arn>

Updates an existing maintenance window.

Only specified parameters are modified.

Modifies the target of an existing maintenance window.

You can change the following:

• Name

• Description

• Owner

• IDs for an ID target

• Tags for a Tag target

• From any supported tag type to another. The three supported tag types are ID target, Tag target, and resource group. For more information, see Target.

Modifies a task assigned to a maintenance window.

You can't change the task type, but you can change the following values:

• TaskARN. For example, you can change a RUN_COMMAND task from AWS-RunPowerShellScript to AWS-RunShellScript.

• ServiceRoleArn

• TaskInvocationParameters

• Priority

• MaxConcurrency

• MaxErrors

One or more targets must be specified for maintenance window Run Command-type tasks. Depending on the task, targets are optional for other maintenance window task types (Automation, AWS Lambda, and AWS Step Functions). For more information about running tasks that do not specify targets, see Registering maintenance window tasks without targets in the AWS Systems Manager User Guide.

If the value for a parameter in UpdateMaintenanceWindowTask is null, then the corresponding field is not modified. If you set Replace to true, then all fields required by the RegisterTaskWithMaintenanceWindow action are required for this request. Optional fields that aren't specified are set to null.

Changes the Amazon Identity and Access Management (IAM) role that is assigned to the on-premises instance or virtual machines (VM).

Edit or change an OpsItem.

You must have permission in AWS Identity and Access Management (IAM) to update an OpsItem. For more information, see Getting started with OpsCenter in the AWS Systems Manager User Guide.

Modifies an existing patch baseline.

Fields not specified in the request are left unchanged.

Update a resource data sync.

After you create a resource data sync for a Region, you can't change the account options for that sync. For example, if you create a sync in the us-east-2 (Ohio) Region and you choose the Include only the current account option, you can't edit that sync later and choose the Include all accounts from my AWS Organizations configuration option. Instead, you must delete the first resource data sync, and create a new one.

ServiceSetting is an account-level setting for an AWS service.

This setting defines how a user interacts with or uses a service or a feature of a service. For example, if an AWS service charges money to the account based on feature or service usage, then the AWS service team might create a default setting of "false". This means the user can't use this feature unless they change the setting to "true" and intentionally opt in for a paid feature.

Services map a SettingId object to a setting value. AWS services teams define the default value for a SettingId. You can't create a new SettingId, but you can overwrite the default value if you have the ssm:UpdateServiceSetting permission for the setting. Use the GetServiceSetting API action to view the current value. Or, use the ResetServiceSetting to change the value back to the original value defined by the AWS service team.